@atlasauth/cli 0.25.1 → 0.27.0

package/dist/help.js

@@ -63,6 +63,7 @@ Commands:
   pages list|push|preview|promote|pull|discard
                              Code-defined hosted-page templates: draft, signed preview link, promote
   init                       Create or complete an app's setup (idempotent); secrets to 0600 files
+  setup-guide                The setup calls in order, with the read-back for each (--json for agents)
   preflight                  Check an instance's setup; non-zero exit on errors (for CI)
   doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)
   golive --origin <url>      Take an instance live for an app origin, step by step; stops at the first failure
@@ -236,14 +237,29 @@ configured instance (key prefixes only, never a key) and whether the app's
 publishable key belongs to it; API reachability and latency; and the
 instance's preflight summary. Network steps time out after 5 s and are
 reported, not fatal. Anything shaped like a secret is redacted.`,
-    import: `atlas import — move users from another auth provider
+    import: `atlas import — move users from another auth provider, or from a JSONL file
 
 Usage:
+  atlas import <users.jsonl> [--dry-run] [--since <ts>] [--on-conflict skip|update]
+                             [--password-policy active|until_email_verified] [--json]
   atlas import --from <vendor> <export-file> [--dry-run]
   atlas import --from better-auth --bundle <file> [--dry-run] [--yes]
   atlas import --from better-auth --import <id> [--confirm-conflicts]
   atlas import --from better-auth             (prints the import key and export command)
 
+With no --from the file has one user per line: external_id and email (required),
+email_verified, password_digest + algorithm, password_salt, password_hash_params,
+oauth_identities [{provider, provider_user_id}], first_name, last_name, created_at,
+updated_at. Any other key is an error, with the line and the nearest real key, and
+nothing is sent. Each row is
+matched by external_id, so running it again changes nothing. --since keeps rows
+updated (or else created) at or after <ts>. --on-conflict skip (the default here)
+leaves existing users alone; update applies rows that changed. It reports created,
+updated, skipped and unverified-with-password counts, and never an email address.
+A hash that cannot be checked is listed by external_id: warning ambiguous_scrypt_salt
+for a hex-looking scrypt salt with no salt_encoding, and unsupported_password_hash for
+a row the API refused.
+
 Vendors and the file each one reads:
   auth0        the user export job (NDJSON/JSON); --hashes <file> merges the password export
   clerk        the dashboard CSV export, or users JSON from the Backend API
@@ -261,6 +277,10 @@ Options:
   --hash-config <file>   Firebase hash parameters: {signer_key, salt_separator, rounds, mem_cost}
   --hashes <file>        Password hashes keyed by email, merged onto the users
   --create-orgs          Create organizations that memberships name but that do not exist yet
+  --since <ts>           Only users created at or after <ts>
+  --on-conflict <mode>   update (the default for --from) or skip a user who already exists
+  --password-policy <p>  active (default), or until_email_verified: an imported hash signs in
+                         only once the address is verified
   --json                 Machine-readable summary
 
 Better Auth bundle (npx atlas-better-auth-export --out <file> --public-key <key>):
@@ -431,7 +451,14 @@ Usage:
   atlas users list [--limit <n>] [--starting-after <cursor>] [--json]
   atlas users get <user-id> [--json]
   atlas users create --email <address> [--first-name <n>] [--last-name <n>] [--password <p>] [--json]
+  atlas users clear-password <user-id> [--json]
   atlas users delete <user-id> [--json]`,
+    'setup-guide': `atlas setup-guide — the setup calls in order, with the read-back for each
+
+Usage: atlas setup-guide [--json]
+
+Prints each step, the exact call or command, and what to read to prove it worked.
+Full guide: https://atlasauth.net/docs/agent-setup`,
     orgs: `atlas orgs — manage organizations
 
 Usage:
@@ -628,7 +655,9 @@ Usage:
              [--email-provider resend|brevo --email-key-file <path|->]
              [--client-redirect <url>]... [--webhook-url <url>]
              [--backchannel <url>]
+             [--with-dev] [--no-env-files --json]
              [--yes] [--force] [--rotate-secret] [--json]
+  atlas init --next [--mount /atlas] [--dir <app-root>] [--force]
 
 Needs a platform key (ATLAS_PLATFORM_KEY, or a psk_ profile from atlas login).
 Finds the app by name and environment, or creates it, then sets strategies, the
@@ -649,18 +678,40 @@ reads stdin). It is never taken from argv and never printed.
 Every secret goes to ~/.config/<product>/<env>*.env (dir 0700, files 0600) and
 is never printed. An existing file is never overwritten without --force.
 --rotate-secret mints a new secret key when the app exists but its file is gone.
-Public values and file paths are kept in ~/.config/<product>/atlas.json.`,
+Public values and file paths are kept in ~/.config/<product>/atlas.json.
+Turns on strict request bodies unless the instance has them or opted out.
+
+--with-dev also creates the development sibling. A new setup then keeps each
+environment in its own folder (~/.config/<product>/production/atlas.env and
+development/atlas.env), so a script reading a folder's *.env files never mixes
+keys. An existing <env>.env stays where it is.
+Without --with-dev the same applies once the folder holds the other environment's
+key: the new environment gets its own folder, and init prints a line saying so.
+--no-env-files writes no secret file: each secret is handed over once in the
+--json output on stdout. Without --json it is refused and names the paths it
+would have written.
+
+--next [--mount <path>] writes, with no key and no network: atlas.yaml, the
+App Router mount and verify routes (src/app when that is where your app is), and
+a .env.example saying which variables are build args (the publishable key only)
+and which are runtime. With --product it sets up the instance as well.`,
     preflight: `atlas preflight — check an instance's setup (a CI / deploy gate)
 
 Usage: atlas preflight [--instance <id> | --product <name> [--instance-env <env>]]
-                       [--fail-on error|warning] [--json]
+                       [--fail-on error|warning] [--fix [--yes]] [--json]
 
-Prints every finding (severity, code, message, fix). Exits 1 when there is an
-error, or with --fail-on warning also on a warning.`,
+Prints every finding (severity, code, message, fix, and the exact call when there
+is one). Exits 1 when there is an error, or with --fail-on warning
+also on a warning.
+
+--fix lists the findings the server marks safe to fix, asks before each call
+(--yes skips the question; needed without a terminal), applies them, runs the
+checks again and prints the result.`,
     doctor: `atlas doctor — integration health (a CI / deploy gate)
 
 Usage: atlas doctor [--instance <id> | --product <name> [--instance-env <env>]]
                     [--only <source,...>] [--no-probe] [--origin <url>] [--json]
+       atlas doctor --scan-dir <path> [--scan-image <ref>] [--json]
 
 Prints every check: setup findings, webhook receivers (with the failing hop:
 dns, tls, http, challenge or auth), back-channel logout, the referral
@@ -670,10 +721,16 @@ fails. --no-probe uses recorded deliveries only (no live calls).
 --origin <url> adds the go-live checks for that app origin to the same report:
 setup errors (preflight), login readiness (live), the path-mount verification
 state on that host, and whether the consent declaration lists every cookie the
-SDKs read (__session, __atlas_uat, __atlas_rt, __client).`,
+SDKs read (__session, __atlas_uat, __atlas_rt, __client).
+
+--scan-dir <path> and --scan-image <ref> need no key. They flag secret keys and
+webhook or hook secrets in Dockerfile ARG / ENV lines, compose build.args, and an
+image's docker history and environment, plus folders whose *.env files hold both
+a development and a production key. Prints the file and line, never the value.
+Exits 1 on a finding. Only the publishable key belongs in a build arg.`,
     golive: `atlas golive — take an instance live for one app origin
 
-Usage: atlas golive --origin <https://app.example.com> [--dry-run] [--json]
+Usage: atlas golive --origin <https://app.example.com> [--dry-run] [--yes] [--json]
                     [--instance <id> | --product <name> [--instance-env <env>]]
 
 Runs, in order, and stops at the first failure with its fix:
@@ -686,6 +743,9 @@ Runs, in order, and stops at the first failure with its fix:
   login_readiness     ready for the origin (live JWKS round-trip)
   integrations        referrals, privacy and identity integrations the instance declares
 
+When verifying the domain would move the issuer, golive prints both issuers and
+the previousIssuers value to add to your verifiers, then stops unless --yes.
+
 --dry-run sends every write with ?dry_run=true: the server validates it and
 nothing changes. Exits 0 when every step passes, 1 on the first failure.`,
     env: `atlas env — print deploy variables without secrets
@@ -813,14 +873,14 @@ Object.assign(exports.COMMAND_HELP, {
     apply: `atlas apply — make the instance match a config file (plan, confirm, apply)
 
 Usage:
-  atlas apply [<file|dir>] [--yes] [--prune] [--force-hook] [--secrets-file <dotenv>] [--out <dir>] [--format json|yaml]
+  atlas apply [<file|dir>] [--yes] [--prune] [--force-hook] [--rotate-secret] [--show-secrets] [--secrets-file <dotenv>] [--out <dir>] [--format json|yaml]
   atlas apply [<file|dir>] --check
 
 <file>  One JSON or YAML document keyed by resource type, for example:
           instance:            { auth_config: {...}, allowed_origins: [...] }
           redirect_urls:       [ { url: ... } ]
           oauth_clients:       [ { name: ..., redirect_uris: [...] } ]
-          webhook_endpoints:   [ { url: ..., enabled_events: [...], active: false } ]
+          webhook_endpoints:   [ { url: ..., enabled_events: [...], secret: "\${WEBHOOK_SECRET}", active: false } ]
           email_provider:      { transport: brevo, from_address: ..., config: { api_key: "\${BREVO_KEY}" } }
           hooks:               { before_user_create: { url: ..., timeout_ms, fail_closed, enabled } }
           branding:            { applicationName: ..., logoUrl: ... }
@@ -836,15 +896,22 @@ Without --prune the plan compares only the keys the file sets.
   --check         plan only; exit 2 when anything would change (CI)
   --prune         also delete live resources missing from the config, and compare every live key
   --force-hook    enable the before_user_create hook even when its test call fails (409)
+  --rotate-secret send again each secret Atlas cannot compare (it never returns them)
+  --show-secrets  print secret values in the diff; refused without a terminal or when CI is set
   --secrets-file  dotenv file for \${VAR} placeholders; refused unless mode 0600
   --out <dir>     where a new client or webhook secret is saved (mode 0600;
                   default ~/.config/atlas). It is shown only once.
-Applying stops if any \${VAR} is unresolved. Provider and hook secrets come only from
-\${VAR} placeholders (--secrets-file) and are shown as "(secret set)", never echoed.`,
+Applying stops if any \${VAR} is unresolved. A key the resource does not have is an
+error, with the nearest real key. So is a provider mode other than native or redirect,
+and a webhook secret that is not whsec_ plus 32 to 256 characters, checked whether or
+not it can be compared. Secrets are never printed: a changed one shows as
+"client_secret: <redacted> (changed)". Where Atlas cannot tell whether a secret changed
+the plan says so instead of showing drift. A changed webhook secret is rotated with no
+overlap: the old one stops signing at once.`,
     plan: `atlas plan — read-only drift diff of a config file or directory
 
 Usage:
-  atlas plan [<file|dir>] [--check|--exit-code] [--json] [--prune] [--secrets-file <dotenv>]
+  atlas plan [<file|dir>] [--check|--exit-code] [--json] [--prune] [--rotate-secret] [--show-secrets] [--secrets-file <dotenv>]
 
 The same diff as 'atlas config plan', also for a single config file (see 'atlas
 apply --help'). --check exits 2 when there is drift; nothing is ever written.`,

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";;;AAAA,oDAA2M;AAC3M;;;;GAIG;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAwGgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA8GmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;;;+CAiBwC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAyE4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;wEAoB+D;IAEtE,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;;;qBAca;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,GAAG,EAAE;;;;;;;;;2EASoE;IACzE,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;6DAesD;IAC3D,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,mBAAmB,EAAE;;;;;;;;;;;;;;;;oCAgBa;IAElC,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA6BqC;IAE5C,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;qBAwBI;IAEnB,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,MAAM,EAAE;;;;;;;;;;;;;0DAagD;IAExD,MAAM,EAAE;;;;;;;;;;;;;;;;yEAgB+D;IAEvE,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAqCgE;IACxE,KAAK,EAAE;;;;;;;;;;;;;;;kDAeyC;IAChD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC;AAEF,sFAAsF;AACtF,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,GAAQ;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,WAAW,IAAI,IAAI,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7I,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,IAAI,MAAM,KAAK;;;EAG/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;;;;YAIN,CAAC;AACb,CAAC;AACD,MAAM,CAAC,MAAM,CAAC,oBAAY,EAAE;IAC1B,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFA8B4E;IACnF,IAAI,EAAE;;;;;;8EAMsE;IAC5E,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,wCAAwC,EAAE,qBAAS,CAAC;IACpF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,0DAA0D,EAAE,gBAAI,CAAC;IACvF,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,2GAA2G,EAAE,oBAAQ,CAAC;IACtJ,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE,uEAAuE,EAAE,wBAAY,CAAC;IAC5H,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,sBAAsB,EAAE,mBAAO,CAAC;IAC5D,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,qEAAqE,EAAE,iBAAK,CAAC;IACrG,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,oCAAoC,EAAE,sBAAU,CAAC;IACrF,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,yCAAyC,EAAE,8BAAkB,CAAC;IAClH,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,qBAAqB,EAAE,oBAAQ,CAAC;IAC9D,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,8CAA8C,EAAE,kBAAM,CAAC;IACjF,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,wCAAwC,EAAE,qBAAS,CAAC;IACpF,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE,eAAG,CAAC;IACjD,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,mCAAmC,EAAE,mBAAO,CAAC;IACzE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,mEAAmE,EAAE,iBAAK,CAAC;IACnG,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,mBAAmB,EAAE,sBAAU,CAAC;IAClE,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,yCAAyC,EAAE,cAAE,CAAC;CACjE,CAAC,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";;;AAAA,oDAA2M;AAC3M;;;;GAIG;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAyGgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA8GmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAsDiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;;;+CAiBwC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAyE4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;wEAoB+D;IAEtE,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;;;qBAca;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;;wCAO+B;IAEtC,aAAa,EAAE;;;;;mDAKkC;IAEjD,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,GAAG,EAAE;;;;;;;;;2EASoE;IACzE,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;6DAesD;IAC3D,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,mBAAmB,EAAE;;;;;;;;;;;;;;;;oCAgBa;IAElC,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA6BqC;IAE5C,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;qBAwBI;IAEnB,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uEAiD+D;IAErE,SAAS,EAAE;;;;;;;;;;;oCAWuB;IAElC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;uEAoB6D;IAErE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;yEAmB+D;IAEvE,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAqCgE;IACxE,KAAK,EAAE;;;;;;;;;;;;;;;kDAeyC;IAChD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC;AAEF,sFAAsF;AACtF,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,GAAQ;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,WAAW,IAAI,IAAI,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7I,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,IAAI,MAAM,KAAK;;;EAG/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;;;;YAIN,CAAC;AACb,CAAC;AACD,MAAM,CAAC,MAAM,CAAC,oBAAY,EAAE;IAC1B,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAqCmC;IAC1C,IAAI,EAAE;;;;;;8EAMsE;IAC5E,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,wCAAwC,EAAE,qBAAS,CAAC;IACpF,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,0DAA0D,EAAE,gBAAI,CAAC;IACvF,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,2GAA2G,EAAE,oBAAQ,CAAC;IACtJ,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE,uEAAuE,EAAE,wBAAY,CAAC;IAC5H,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,sBAAsB,EAAE,mBAAO,CAAC;IAC5D,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,qEAAqE,EAAE,iBAAK,CAAC;IACrG,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,oCAAoC,EAAE,sBAAU,CAAC;IACrF,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,yCAAyC,EAAE,8BAAkB,CAAC;IAClH,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,qBAAqB,EAAE,oBAAQ,CAAC;IAC9D,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,8CAA8C,EAAE,kBAAM,CAAC;IACjF,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,wCAAwC,EAAE,qBAAS,CAAC;IACpF,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE,eAAG,CAAC;IACjD,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,mCAAmC,EAAE,mBAAO,CAAC;IACzE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,mEAAmE,EAAE,iBAAK,CAAC;IACnG,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,mBAAmB,EAAE,sBAAU,CAAC;IAClE,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,yCAAyC,EAAE,cAAE,CAAC;CACjE,CAAC,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The CLI's one output-side secret filter. Every change a plan prints, every
+ * `--json` report of plan / preflight / golive and every API error passes through
+ * here, so a resource added later cannot leak by forgetting to mask a field.
+ *
+ *  - {@link isSecretKey}: a field name that holds a secret. Names that only mention
+ *    the word (`token_endpoint`, `password_policy`, `secret_key_prefix`) are not.
+ *  - {@link redactDeep}: masks secret-named strings at any depth, and scrubs the rest.
+ *  - {@link scrubText}: removes known values, Atlas-key-shaped values and
+ *    `name=value` pairs from free text.
+ *  - {@link rememberResolved}: records what a `${VAR}` placeholder resolved to, so a
+ *    secret under an unexpected key still cannot print. {@link scrubbingIO} applies
+ *    those values to everything the command writes.
+ *
+ * The state is per `run()`; {@link resetRedaction} clears it.
+ */
+import type { IO } from './io';
+export declare const REDACTED = "<redacted>";
+/** True for a field name whose string value is a secret. */
+export declare function isSecretKey(key: string): boolean;
+/** An unresolved `${VAR}` is a name, not a value: it stays visible (apply refuses it). */
+export declare const isPlaceholder: (v: unknown) => boolean;
+/** The secret formats Atlas mints: `atlas_<env>_<kind>_…`, and the legacy `sk_<env>_`, `psk_`, `dsk_`, `whsec_`. */
+export declare const SECRET_VALUE_SOURCE = "\\b(?:atlas_(?:live|test)_(?:sk|psk|dsk|whsec|pl|at)_[A-Za-z0-9]+|(?:sk_(?:live|test)|psk|dsk|whsec)_[A-Za-z0-9_\\-+/=]+)";
+/** Forget the remembered values and leave `--show-secrets` off. */
+export declare function resetRedaction(): void;
+/** `--show-secrets`: the caller has checked it is allowed here. */
+export declare function setRevealSecrets(on: boolean): void;
+export declare const revealingSecrets: () => boolean;
+/** Remember what a `${VAR}` under `key` resolved to. Public values (a client id, a plain URL) stay printable. */
+export declare function rememberResolved(key: string | undefined, value: string): void;
+/** Remove known values, key-shaped values and secret `name=value` pairs from free text. */
+export declare function scrubText(text: string): string;
+/** A copy with every secret-named string masked and every other string scrubbed. */
+export declare function redactDeep<T>(value: T, key?: string): T;
+/**
+ * The sinks every command writes through, without any value `${VAR}` resolved to.
+ * Only remembered values: a secret a command prints on purpose (`--print-secret`)
+ * was never remembered, so it still prints.
+ */
+export declare function scrubbingIO(io: IO): IO;

package/dist/redact.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revealingSecrets = exports.SECRET_VALUE_SOURCE = exports.isPlaceholder = exports.REDACTED = void 0;
+exports.isSecretKey = isSecretKey;
+exports.resetRedaction = resetRedaction;
+exports.setRevealSecrets = setRevealSecrets;
+exports.rememberResolved = rememberResolved;
+exports.scrubText = scrubText;
+exports.redactDeep = redactDeep;
+exports.scrubbingIO = scrubbingIO;
+exports.REDACTED = '<redacted>';
+const SECRET_WORD = /secret|token|password|passwd|api_?key|private_?key|signing_?key|encryption_?key|access_?key|credential|authorization/;
+/** The name describes the secret rather than holding it. */
+const DESCRIBES_IT = /_(endpoint|url|uri|method|policy|prefix|format|ttl|seconds|lifetimes?|params|set|file|files|at|type|name|id|ref|hint|hasher|alg|algorithm|enabled|required|source|length|mode|count|version)$/;
+/** True for a field name whose string value is a secret. */
+function isSecretKey(key) {
+    const snake = key.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+    // `has_secret`, `is_token`: a flag about the secret, never the secret.
+    return SECRET_WORD.test(snake) && !DESCRIBES_IT.test(snake) && !/^(has|is)_/.test(snake);
+}
+const PLACEHOLDER = /^\$\{[A-Z0-9_]+\}$/;
+/** An unresolved `${VAR}` is a name, not a value: it stays visible (apply refuses it). */
+const isPlaceholder = (v) => typeof v === 'string' && PLACEHOLDER.test(v);
+exports.isPlaceholder = isPlaceholder;
+/** The secret formats Atlas mints: `atlas_<env>_<kind>_…`, and the legacy `sk_<env>_`, `psk_`, `dsk_`, `whsec_`. */
+exports.SECRET_VALUE_SOURCE = '\\b(?:atlas_(?:live|test)_(?:sk|psk|dsk|whsec|pl|at)_[A-Za-z0-9]+|(?:sk_(?:live|test)|psk|dsk|whsec)_[A-Za-z0-9_\\-+/=]+)';
+const SECRET_VALUE = new RegExp(exports.SECRET_VALUE_SOURCE, 'g');
+const KEY_VALUE = /(["']?)([A-Za-z][\w-]*)\1(\s*[:=]\s*)("(?:[^"\\]|\\.)*"|'[^']*'|[^\s,&;}"']+)/g;
+const BEARER = /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/g;
+const known = new Set();
+let reveal = false;
+/** Forget the remembered values and leave `--show-secrets` off. */
+function resetRedaction() {
+    known.clear();
+    reveal = false;
+}
+/** `--show-secrets`: the caller has checked it is allowed here. */
+function setRevealSecrets(on) {
+    reveal = on;
+}
+const revealingSecrets = () => reveal;
+exports.revealingSecrets = revealingSecrets;
+/** Below this a value is too short to scrub without mangling ordinary words; a secret-named key is masked anyway. */
+const MIN_SCRUB_LENGTH = 6;
+const PUBLIC_KEY = /(^|_)client_id$|^provider$|^from_address$/i;
+function isPlainUrl(v) {
+    try {
+        const u = new URL(v);
+        return (u.protocol === 'https:' || u.protocol === 'http:') && !u.username && !u.password && !u.search;
+    }
+    catch {
+        return false;
+    }
+}
+/** Remember what a `${VAR}` under `key` resolved to. Public values (a client id, a plain URL) stay printable. */
+function rememberResolved(key, value) {
+    if (value.length < MIN_SCRUB_LENGTH)
+        return;
+    if (!(key && isSecretKey(key)) && ((key && PUBLIC_KEY.test(key)) || isPlainUrl(value)))
+        return;
+    known.add(value);
+    known.add(JSON.stringify(value).slice(1, -1));
+}
+function scrubKnown(text) {
+    if (reveal || known.size === 0)
+        return text;
+    let out = text;
+    for (const v of [...known].sort((a, b) => b.length - a.length))
+        out = out.split(v).join(exports.REDACTED);
+    return out;
+}
+/** Remove known values, key-shaped values and secret `name=value` pairs from free text. */
+function scrubText(text) {
+    if (reveal)
+        return text;
+    return scrubKnown(text)
+        .replace(SECRET_VALUE, exports.REDACTED)
+        .replace(BEARER, `Bearer ${exports.REDACTED}`)
+        .replace(KEY_VALUE, (match, _q, name, sep, value) => {
+        // `<value>` in a help line is a placeholder too.
+        if (!isSecretKey(name) || (0, exports.isPlaceholder)(value) || /^<[\w-]+>$/.test(value))
+            return match;
+        const quoted = value.startsWith('"') || value.startsWith("'");
+        // `client_secret: missing` is prose; `client_secret: 8f3a91c2…` and `token=abc` are not.
+        if (!quoted && sep.includes(':') && value.length < 8)
+            return match;
+        const q = quoted ? value[0] : '';
+        return `${match.slice(0, match.length - value.length)}${q}${exports.REDACTED}${q}`;
+    });
+}
+/** A copy with every secret-named string masked and every other string scrubbed. */
+function redactDeep(value, key) {
+    if (reveal)
+        return value;
+    if (typeof value === 'string') {
+        if (key && isSecretKey(key) && value !== '' && !(0, exports.isPlaceholder)(value))
+            return exports.REDACTED;
+        return scrubText(value);
+    }
+    if (Array.isArray(value))
+        return value.map((v) => redactDeep(v, key));
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactDeep(v, k)]));
+    }
+    return value;
+}
+/**
+ * The sinks every command writes through, without any value `${VAR}` resolved to.
+ * Only remembered values: a secret a command prints on purpose (`--print-secret`)
+ * was never remembered, so it still prints.
+ */
+function scrubbingIO(io) {
+    return { out: (t) => io.out(scrubKnown(t)), err: (t) => io.err(scrubKnown(t)) };
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":";;;AAyBA,kCAIC;AAiBD,wCAGC;AAGD,4CAEC;AAiBD,4CAKC;AAUD,8BAcC;AAGD,gCAWC;AAOD,kCAEC;AAzGY,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC,MAAM,WAAW,GAAG,sHAAsH,CAAC;AAC3I,4DAA4D;AAC5D,MAAM,YAAY,GAAG,+LAA+L,CAAC;AAErN,4DAA4D;AAC5D,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,uEAAuE;IACvE,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,WAAW,GAAG,oBAAoB,CAAC;AACzC,0FAA0F;AACnF,MAAM,aAAa,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAAtF,QAAA,aAAa,iBAAyE;AAEnG,oHAAoH;AACvG,QAAA,mBAAmB,GAC9B,2HAA2H,CAAC;AAC9H,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,2BAAmB,EAAE,GAAG,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,gFAAgF,CAAC;AACnG,MAAM,MAAM,GAAG,oCAAoC,CAAC;AAEpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;AAChC,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,mEAAmE;AACnE,SAAgB,cAAc;IAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC;AAED,mEAAmE;AACnE,SAAgB,gBAAgB,CAAC,EAAW;IAC1C,MAAM,GAAG,EAAE,CAAC;AACd,CAAC;AACM,MAAM,gBAAgB,GAAG,GAAY,EAAE,CAAC,MAAM,CAAC;AAAzC,QAAA,gBAAgB,oBAAyB;AAEtD,qHAAqH;AACrH,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,UAAU,GAAG,4CAA4C,CAAC;AAEhE,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iHAAiH;AACjH,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,KAAa;IACrE,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO;IAC5C,IAAI,CAAC,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO;IAC/F,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAQ,CAAC,CAAC;IAClG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,SAAgB,SAAS,CAAC,IAAY;IACpC,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,UAAU,CAAC,IAAI,CAAC;SACpB,OAAO,CAAC,YAAY,EAAE,gBAAQ,CAAC;SAC/B,OAAO,CAAC,MAAM,EAAE,UAAU,gBAAQ,EAAE,CAAC;SACrC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,IAAY,EAAE,GAAW,EAAE,KAAa,EAAE,EAAE;QAClF,iDAAiD;QACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,IAAA,qBAAa,EAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzF,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9D,yFAAyF;QACzF,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,gBAAQ,GAAG,CAAC,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;AACP,CAAC;AAED,oFAAoF;AACpF,SAAgB,UAAU,CAAI,KAAQ,EAAE,GAAY;IAClD,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,IAAA,qBAAa,EAAC,KAAK,CAAC;YAAE,OAAO,gBAAa,CAAC;QAC3F,OAAO,SAAS,CAAC,KAAK,CAAM,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAM,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,EAAM;IAChC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClF,CAAC"}

package/dist/run.d.ts

@@ -1,5 +1,5 @@
 import { type ParsedArgs } from './args';
-import type { RunContext } from './context';
+import { type RunContext } from './context';
 /** A command handler: given the context and parsed args, do the work; return an exit code. */
 export type Handler = (ctx: RunContext, args: ParsedArgs) => Promise<number>;
 /**
@@ -9,4 +9,4 @@ export type Handler = (ctx: RunContext, args: ParsedArgs) => Promise<number>;
  * captured IO. All error reporting funnels through the one try/catch so a user
  * sees a clean message and a non-zero code — never a stack trace.
  */
-export declare function run(argv: string[], ctx: RunContext): Promise<number>;
+export declare function run(argv: string[], rawCtx: RunContext): Promise<number>;

package/dist/run.js

@@ -32,8 +32,11 @@ const id_accounts_1 = require("./commands/id-accounts");
 const admin_1 = require("./commands/admin");
 const partner_platforms_1 = require("./commands/partner-platforms");
 const resources_1 = require("./commands/resources");
+const context_1 = require("./context");
 const errors_1 = require("./errors");
 const help_1 = require("./help");
+const redact_1 = require("./redact");
+const setup_guide_1 = require("./commands/setup-guide");
 const version_1 = require("./version");
 /** The command table — the single place every top-level command is registered. */
 const COMMANDS = {
@@ -57,6 +60,7 @@ const COMMANDS = {
     actions: actions_1.actions,
     pages: pages_1.pages,
     init: init_1.init,
+    'setup-guide': setup_guide_1.setupGuide,
     preflight: project_commands_1.preflight,
     doctor: project_commands_1.doctor,
     golive: golive_1.golive,
@@ -97,7 +101,9 @@ const COMMANDS = {
  * captured IO. All error reporting funnels through the one try/catch so a user
  * sees a clean message and a non-zero code — never a stack trace.
  */
-async function run(argv, ctx) {
+async function run(argv, rawCtx) {
+    (0, redact_1.resetRedaction)();
+    const ctx = { ...rawCtx, io: (0, redact_1.scrubbingIO)(rawCtx.io) };
     let args;
     try {
         args = (0, args_1.parse)(argv);
@@ -110,6 +116,12 @@ async function run(argv, ctx) {
         ctx.io.out((0, version_1.getVersion)());
         return 0;
     }
+    if (args.values['show-secrets']) {
+        if (!(0, context_1.ttyOf)(ctx).stdout || ctx.env.CI) {
+            return report(ctx, new errors_1.CliError('--show-secrets needs a terminal: it is refused when stdout is not a TTY or CI is set.'));
+        }
+        (0, redact_1.setRevealSecrets)(true);
+    }
     const command = args.positionals[0];
     // Bare `atlas` or `atlas --help`: top-level help on stdout, success.
     if (!command) {
@@ -143,15 +155,15 @@ async function run(argv, ctx) {
 function report(ctx, err) {
     if (err instanceof backend_1.AtlasApiError) {
         const code = err.code ? ` [${err.code}]` : '';
-        ctx.io.err(`atlas: API error (HTTP ${err.status})${code}: ${err.message}`);
+        ctx.io.err(`atlas: API error (HTTP ${err.status})${code}: ${(0, redact_1.scrubText)(err.message)}`);
         return 1;
     }
     if (err instanceof errors_1.CliError) {
-        ctx.io.err(`atlas: ${err.message}`);
+        ctx.io.err(`atlas: ${(0, redact_1.scrubText)(err.message)}`);
         return err.exitCode;
     }
     const message = err instanceof Error ? err.message : String(err);
-    ctx.io.err(`atlas: ${message}`);
+    ctx.io.err(`atlas: ${(0, redact_1.scrubText)(message)}`);
     return 1;
 }
 //# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AAyGA,kBAwCC;AAjJD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,4CAAyC;AACzC,kDAA8C;AAC9C,0CAAwD;AACxD,kDAAkD;AAClD,8CAAsE;AACtE,0CAAuC;AACvC,8CAA2C;AAC3C,8CAAgD;AAChD,0CAAuC;AACvC,wCAAqC;AACrC,wCAAqC;AACrC,wCAAqC;AACrC,8CAA2C;AAC3C,gDAA6C;AAC7C,wDAAoD;AACpD,wCAAqC;AACrC,kEAAoF;AACpF,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,8CAA2C;AAC3C,4CAAyC;AACzC,kDAA+C;AAC/C,0DAAuD;AACvD,wDAAoD;AACpD,4CAAyC;AACzC,oEAAgE;AAChE,oDAG8B;AAE9B,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,gBAAK;IACL,IAAI,EAAJ,eAAI;IACJ,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,YAAY,EAAZ,2BAAY;IACZ,mBAAmB,EAAE,oCAAgB;IACrC,aAAa,EAAE,wBAAU;IACzB,KAAK,EAAL,aAAK;IACL,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,IAAI,EAAE,oBAAW;IACjB,KAAK,EAAE,qBAAY;IACnB,OAAO,EAAP,iBAAO;IACP,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,MAAM,EAAN,yBAAM;IACN,MAAM,EAAN,eAAM;IACN,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAN,eAAM;IACN,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;IACH,MAAM,EAAN,eAAM;IACN,GAAG,EAAH,SAAG;IACH,aAAa,EAAE,wBAAU;IACzB,GAAG,EAAH,SAAG;IACH,GAAG,EAAH,SAAG;IACH,SAAS,EAAE,IAAA,2BAAe,EAAC,WAAW,EAAE,qBAAS,CAAC;IAClD,IAAI,EAAE,IAAA,2BAAe,EAAC,MAAM,EAAE,gBAAI,CAAC;IACnC,KAAK,EAAE,IAAA,2BAAe,EAAC,OAAO,EAAE,iBAAK,CAAC;IACtC,UAAU,EAAE,IAAA,2BAAe,EAAC,UAAU,EAAE,oBAAQ,CAAC;IACjD,YAAY,EAAE,IAAA,2BAAe,EAAC,cAAc,EAAE,wBAAY,CAAC;IAC3D,OAAO,EAAE,IAAA,2BAAe,EAAC,SAAS,EAAE,mBAAO,CAAC;IAC5C,YAAY,EAAE,IAAA,2BAAe,EAAC,YAAY,EAAE,sBAAU,CAAC;IACvD,oBAAoB,EAAE,IAAA,2BAAe,EAAC,oBAAoB,EAAE,8BAAkB,CAAC;IAC/E,QAAQ,EAAE,IAAA,2BAAe,EAAC,UAAU,EAAE,oBAAQ,CAAC;IAC/C,MAAM,EAAE,IAAA,2BAAe,EAAC,QAAQ,EAAE,kBAAM,CAAC;IACzC,SAAS,EAAE,IAAA,2BAAe,EAAC,WAAW,EAAE,qBAAS,CAAC;IAClD,GAAG,EAAE,IAAA,2BAAe,EAAC,KAAK,EAAE,eAAG,CAAC;IAChC,OAAO,EAAE,IAAA,2BAAe,EAAC,SAAS,EAAE,mBAAO,CAAC;IAC5C,KAAK,EAAE,IAAA,2BAAe,EAAC,OAAO,EAAE,iBAAK,CAAC;IACtC,UAAU,EAAE,IAAA,2BAAe,EAAC,YAAY,EAAE,sBAAU,CAAC;IACrD,EAAE,EAAE,IAAA,2BAAe,EAAC,IAAI,EAAE,cAAE,CAAC;CAC9B,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AA4GA,kBAiDC;AA7JD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,4CAAyC;AACzC,kDAA8C;AAC9C,0CAAwD;AACxD,kDAAkD;AAClD,8CAAsE;AACtE,0CAAuC;AACvC,8CAA2C;AAC3C,8CAAgD;AAChD,0CAAuC;AACvC,wCAAqC;AACrC,wCAAqC;AACrC,wCAAqC;AACrC,8CAA2C;AAC3C,gDAA6C;AAC7C,wDAAoD;AACpD,wCAAqC;AACrC,kEAAoF;AACpF,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,8CAA2C;AAC3C,4CAAyC;AACzC,kDAA+C;AAC/C,0DAAuD;AACvD,wDAAoD;AACpD,4CAAyC;AACzC,oEAAgE;AAChE,oDAG8B;AAC9B,uCAAmD;AACnD,qCAAoC;AACpC,iCAAgD;AAChD,qCAAoF;AACpF,wDAAoD;AACpD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,gBAAK;IACL,IAAI,EAAJ,eAAI;IACJ,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,YAAY,EAAZ,2BAAY;IACZ,mBAAmB,EAAE,oCAAgB;IACrC,aAAa,EAAE,wBAAU;IACzB,KAAK,EAAL,aAAK;IACL,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,IAAI,EAAE,oBAAW;IACjB,KAAK,EAAE,qBAAY;IACnB,OAAO,EAAP,iBAAO;IACP,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,aAAa,EAAE,wBAAU;IACzB,SAAS,EAAT,4BAAS;IACT,MAAM,EAAN,yBAAM;IACN,MAAM,EAAN,eAAM;IACN,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAN,eAAM;IACN,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;IACH,MAAM,EAAN,eAAM;IACN,GAAG,EAAH,SAAG;IACH,aAAa,EAAE,wBAAU;IACzB,GAAG,EAAH,SAAG;IACH,GAAG,EAAH,SAAG;IACH,SAAS,EAAE,IAAA,2BAAe,EAAC,WAAW,EAAE,qBAAS,CAAC;IAClD,IAAI,EAAE,IAAA,2BAAe,EAAC,MAAM,EAAE,gBAAI,CAAC;IACnC,KAAK,EAAE,IAAA,2BAAe,EAAC,OAAO,EAAE,iBAAK,CAAC;IACtC,UAAU,EAAE,IAAA,2BAAe,EAAC,UAAU,EAAE,oBAAQ,CAAC;IACjD,YAAY,EAAE,IAAA,2BAAe,EAAC,cAAc,EAAE,wBAAY,CAAC;IAC3D,OAAO,EAAE,IAAA,2BAAe,EAAC,SAAS,EAAE,mBAAO,CAAC;IAC5C,YAAY,EAAE,IAAA,2BAAe,EAAC,YAAY,EAAE,sBAAU,CAAC;IACvD,oBAAoB,EAAE,IAAA,2BAAe,EAAC,oBAAoB,EAAE,8BAAkB,CAAC;IAC/E,QAAQ,EAAE,IAAA,2BAAe,EAAC,UAAU,EAAE,oBAAQ,CAAC;IAC/C,MAAM,EAAE,IAAA,2BAAe,EAAC,QAAQ,EAAE,kBAAM,CAAC;IACzC,SAAS,EAAE,IAAA,2BAAe,EAAC,WAAW,EAAE,qBAAS,CAAC;IAClD,GAAG,EAAE,IAAA,2BAAe,EAAC,KAAK,EAAE,eAAG,CAAC;IAChC,OAAO,EAAE,IAAA,2BAAe,EAAC,SAAS,EAAE,mBAAO,CAAC;IAC5C,KAAK,EAAE,IAAA,2BAAe,EAAC,OAAO,EAAE,iBAAK,CAAC;IACtC,UAAU,EAAE,IAAA,2BAAe,EAAC,YAAY,EAAE,sBAAU,CAAC;IACrD,EAAE,EAAE,IAAA,2BAAe,EAAC,IAAI,EAAE,cAAE,CAAC;CAC9B,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,MAAkB;IAC1D,IAAA,uBAAc,GAAE,CAAC;IACjB,MAAM,GAAG,GAAe,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAA,oBAAW,EAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAClE,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAA,eAAK,EAAC,GAAG,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,iBAAQ,CAAC,uFAAuF,CAAC,CAAC,CAAC;QAC5H,CAAC;QACD,IAAA,yBAAgB,EAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,IAAA,kBAAS,EAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,IAAA,kBAAS,EAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,IAAA,kBAAS,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/cli",
-  "version": "0.25.1",
+  "version": "0.27.0",
   "description": "atlas — manage an Atlas instance from the terminal via the Backend API.",
   "bin": {
     "atlas": "dist/cli.js"
@@ -16,12 +16,12 @@
   },
   "dependencies": {
     "yaml": "^2.6.0",
+    "@atlasauth/emulator": "0.1.0",
     "@atlasauth/actions": "0.5.0",
-    "@atlasauth/backend": "0.35.0",
     "@atlasauth/migrate": "0.2.0",
-    "@atlasauth/upgrade": "0.7.0",
+    "@atlasauth/backend": "0.37.0",
     "@atlasauth/referral-conformance": "0.2.1",
-    "@atlasauth/emulator": "0.1.0"
+    "@atlasauth/upgrade": "0.7.0"
   },
   "devDependencies": {
     "@types/node": "^22.9.0",